Engineered for Consumer & Team Protection
ScamCheck provides multi-vector inspection for links, messages, emails, QR codes, and screenshots. Every check is grounded in deterministic heuristics and authoritative threat intelligence.
URL & Domain Heuristic Inspection
Deep structural inspection of suspicious destinations before browser interaction.
- •Punycode and IDN homograph attack identification (e.g. Cyrillic vs Latin glyphs).
- •Brand typosquatting detection with leetspeak substitution normalization.
- •RFC syntax decomposition: apex domain, excessive subdomain depth, and suspicious path tokens.
- •Controlled redirect chain resolution (up to 3 hops) with SSRF revalidation at every step.
- •Plaintext HTTP authentication endpoint warnings.
Conversational Message Analysis
Linguistic and behavioral pattern recognition designed for conversational deception.
- •Courier and redelivery parcel smishing identification.
- •One-Time Passcode (OTP) and two-factor authentication solicitation detection.
- •Unsolicited financial demands, cryptocurrency wallet solicitations, and gift card fraud.
- •Coercive authority impersonation and arrest threat recognition.
- •Automated extraction and isolated static inspection of embedded links.
Email Phishing & Spoofing Shield
Sender alignment, deceptive display names, and attachment risk evaluation.
- •Display name impersonation checks (e.g. 'Apple Support' from unrelated TLDs).
- •Commercial and institutional claims originating from free consumer webmail.
- •High-risk executable and script attachment warnings (.exe, .scr, .iso, .zip.exe).
- •Account suspension and coercive deactivation pretext identification.
- •Domain mismatch detection between sender identity and referenced links.
QR Code Destination Sandbox
Server-side QR destination extraction and inspection before physical device scanning.
- •Drag-and-drop QR image decoding in a sandboxed execution context.
- •Inspection of destination security posture before opening links on personal mobile devices.
- •Detection of obfuscated redirectors and malicious URL shorteners.
- •SSRF guard prevents QR links from resolving to private subnets or internal cloud resources.
Screenshot OCR Extraction Engine
Automated Optical Character Recognition extracts and analyzes text from screenshots.
- •Processes screenshots of SMS, WhatsApp, Telegram, emails, and mobile payment requests.
- •Extracts phone numbers, links, and commercial brand mentions automatically.
- •Evaluates detected links through the SSRF shield without auto-visiting destinations.
- •Flags low-confidence OCR scans transparently without hallucinating text.
Deterministic Risk Engine & Breakdown
Zero-hallucination, deterministic security scoring with 5-vector breakdown.
- •0 to 100 numerical risk scoring with configurable weights.
- •5 distinct vector progress meters: Domain, URL, Brand, Social Engineering, and HTTPS.
- •Threat classification into 18 recognized scam types.
- •Evidence-based 'Why ScamCheck Flagged This' rationale derived strictly from detected facts.
Looking for organizational or team deployment?
ScamCheck provides server-side PDF exports, sanitized public share tokens, and API compatibility for IT teams and internal digital resilience workflows.